chore(deps): bump flask-caching from 2.4.1 to 2.5.0

[dependabot]

Bumps flask-caching from 2.4.1 to 2.5.0.

Release notes

Sourced from flask-caching's releases.

2.5.0

Note: This release will invalidate your caches because we changed the default hash_method from hashlib.md5 to hashlib.sha256. This can be changed back via CACHE_HASH_METHOD if you wish to still use the old hash_method!

Added / Improved

• Specifying timeouts now also works with datetime.timedelta. #266
• Add config option CACHE_SERIALIZER to set the cachelib serializer the backend uses. #209
• cachelib backends can now be configured directly via CACHE_TYPE="cachelib.ValkeyCache. #668
• Send Signals for cache hits and misses. #237 and #667
• Add Cache.delete_cached() and extend make_cache_key() with path and query_args arguments to make deleting views decorated with cached(query_string=True) possible. #243
• Add CACHE_HASH_METHOD to set the hash method used for the cache keys of @cached and @memoize.
• Add an is_stale option to @cached and @memoize. It is called on a cache hit with the cached value. Unlike forced_update it uses the value itself to check whether the cache is stale. Can be used in combination with forced_update #392
• @cached and @memoize now preserve the wrapped function's signature and expose uncached, cache_timeout, make_cache_key delete_memoized to type checkers.
• Add CACHE_FILE_HASH_METHOD config option to FileSystemCache to allow using a different hash function for cache keys. #660
• Add pool_size and pool_blocking to make MemcachedCache backends thread-safe. #663
• Document that CACHE_REDIS_HOST accepts an already created redis.Redis client instead of a host name, which allows sharing a connection pool with other extensions and the application. #629
• Clarify docs about decorator order regarding @staticmethod and @classmethod when memoizing. #440
• Modify SimpleCache docs as it's now thread-safe using an RLock for all operations. #663

Changed

• Drop support for Python 3.10 and require cachelib 0.17.0+
• Remove the deprecated lowercase CACHE_TYPE names (null, simple, filesystem, redis, redissentinel, rediscluster, uwsgi, memcached, gaememcached, saslmemcached and spreadsaslmemcached)
• Use hashlib.sha256 instead of hashlib.md5 for hashing the cache keys. This changes the generated keys, so entries cached by an earlier version become obsolete. If you wish to still use hashlib.md5 set the config CACHE_HASH_METHOD = hashlib.md5. #563
• @cached and @memoize now go through the public Cache proxy methods (get, set, has, delete, delete_many, get_many and set_many) instead of calling the backend directly. #417
• CACHE_IGNORE_ERRORS is now used by every backend instead of only SimpleCache and FileSystemCache.
• The delete_many method is now used from cachelib. A key that does not exist counts as deleted, and with CACHE_IGNORE_ERRORS set to False a RuntimeError is raised if the key could not be deleted.
• Call @memoize forced_update callbacks once per decorated function call instead of once while making the key and again before cache lookup. #387
• @cached now caches an HTTPException raised by the view (i.e. through abort()). This exception will now be re-raises on a cache hit. Use response_filter, to keep the exception out of the cache. #444
• The {% cache %} Jinja tag no longer propagates backend errors. If the cache is unavailable, the block is rendered normally instead of raising, matching the existing behavior of @memoize. #564 #565

Fixed

• Include key_prefix when building @cached(query_string=True) cache keys. #302
• Fix a @memoize cache-key collision when a parameter has a falsy default (e.g. 0, "", False): calling with the default was keyed the same as passing None, returning the wrong cached result. #656
• Fix @cached(response_hit_indication=True) appending a new after_request function to the app on every request.
• Fix a view returning an iterator of strings, for example when using flask.stream_template it previously returned a list of JSON strings instead of the rendered template. #511
• Fix __caching_id__ never being usable. @memoize silently ignored that and ran the function uncached.
• delete_memoized now takes the instance from a bound method, so cache.delete_memoized(obj.method, 1) deletes the cache for obj.method(1) instead of silently deleting nothing. The current behaviour by passing the instance keeps working as well. #554
• Fix @memoize invalidating a function's entire cache by not updating the memoize version key's timeout. It is now refreshed each time an entry is written, with that entry's own timeout. #531

New Contributors

• @​uttam12331 made their first contribution in pallets-eco/flask-caching#656
• @​deepakganesh78 made their first contribution in pallets-eco/flask-caching#655
• @​nightcityblade made their first contribution in pallets-eco/flask-caching#665
• @​dzpt made their first contribution in pallets-eco/flask-caching#565
• @​aoright made their first contribution in pallets-eco/flask-caching#672

Full Changelog: pallets-eco/flask-caching@v2.4.1...v2.5.0

Changelog

Sourced from flask-caching's changelog.

Version 2.5.0

Released 2026-08-24

• Specifying timeouts now also works with datetime.timedelta. :issue:266
• Add config option CACHE_SERIALIZER to set the cachelib serializer the backend uses. :issue:209
• cachelib backends can now be configured directly via CACHE_TYPE="cachelib.ValkeyCache. :pr:668
• @cached and @memoize now go through the public Cache proxy methods (get, set, has, delete, delete_many, get_many and set_many) instead of calling the backend directly. :issue:417
• Document that CACHE_REDIS_HOST accepts an already created redis.Redis client instead of a host name, which allows sharing a connection pool with other extensions and the application. :issue:629
• Send Signals for cache hits and misses. :pr:[#237](https://github.com/pallets-eco/flask-caching/issues/237) and :pr:667
• Include key_prefix when building @cached(query_string=True) cache keys. :issue:302
• Add Cache.delete_cached() and extend make_cache_key() with path and query_args arguments to make deleting views decorated with cached(query_string=True) possible. :issue:243
• Use hashlib.sha256 instead of hashlib.md5 for hashing the cache keys. This changes the generated keys, so entries cached by an earlier version become obsolete. If you wish to still use hashlib.md5 set the config CACHE_HASH_METHOD = hashlib.md5. :pr:563
• Add CACHE_HASH_METHOD to set the hash method used for the cache keys of @cached and @memoize.
• Drop support for Python 3.10 and require cachelib 0.17.0+
• CACHE_IGNORE_ERRORS is now used by every backend instead of only SimpleCache and FileSystemCache.
• The delete_many method is now used from cachelib. A key that does not exist counts as deleted, and with CACHE_IGNORE_ERRORS set to False a RuntimeError is raised if the key could not be deleted.
• Clarify docs about decorator order regarding @staticmethod and @classmethod when memoizing. :issue:440
• Remove the deprecated lowercase CACHE_TYPE names (null, simple, filesystem, redis, redissentinel, rediscluster, uwsgi, memcached, gaememcached, saslmemcached and spreadsaslmemcached)
• Call @memoize forced_update callbacks once per decorated function call instead of once while making the key and again before cache lookup. :issue:387
• Add an is_stale option to @cached and @memoize. It is called on a cache hit with the cached value. Unlike forced_update it uses the value itself to check whether the cache is stale. Can be used in combination with forced_update :issue:392
• @cached now caches an HTTPException raised by the view (i.e. through abort()). This exception will now be re-raises on a cache hit. Use response_filter, to keep the exception out of the cache. :issue:444

... (truncated)

Commits

• 8dd912a Update publish workflow
• 01f0e3f Version 2.5.0
• 66a8e05 Improve exception handling for the cached decorator. Fixes #444
• b09952d Bump cachelib to 0.17.0
• fca9ac2 Convert str to int instead of casting
• 61810d9 Add support for specifying timeouts with timedelta. Fixes #266
• dde19bb Clarify request.method caching. See #270
• bab22fb Add is_stale. Fixes #392
• 2f993e7 bump cachelib with fix of ping
• ddb9953 fix pinging for fake clients
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bito-code-review]

Code Review Agent Run #4cebb4

Actionable Suggestions - 0

Additional Suggestions - 1

• pyproject.toml - 1

  • Lock files out of sync · Line 57-57
    The lock files `requirements/base.txt:129` and `requirements/development.txt:276` still pin `flask-caching==2.4.1`. `check-python-deps.yml` runs `uv-pip-compile.sh` and fails on this drift, so this PR will fail CI until the pins are regenerated. The `sync-requirements-for-python-dep-upgrade-pr.yml` workflow should auto-commit them; if not, run `./scripts/uv-pip-compile.sh`.

Review Details

• Files reviewed - 1 · Commit Range: 950aca8..950aca8

  • pyproject.toml
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Code Review Agent Run #906cec

Actionable Suggestions - 0

Review Details

• Files reviewed - 2 · Commit Range: 950aca8..10f99ee

  • requirements/base.txt
  • requirements/development.txt
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers an incremental AI Review.

• /review full - Manually triggers a full AI Review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by